CRYPTOME 



19 May 2014 

Ryan Devereaux, The Intercept, released on 19 May 2014 these 12 pages of NSA documents obtained by Edward 
Snowden. 

Related article: 

https://firstlook.orq/theintercept/article/2014/05/19/data-pirates-caribbean-nsa-recordinq-everv-cell-phone-call-bahamas/ 
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Talking Points: 



Approx. 10-15 
SiGINT Reports per 
week from Mystic 
sites other than 
Scalawag 




from Mystic sites 
other than Scalawag, 
Oilyrag, and 
Acidwash for the 
week of April 21st- 
April 27th 



(U//FOUO) MYSTIC Reporting 
(Excluding Scalawag) 




U Rancidrinse 
£1 Permanent Press 
LJ Oilyrag 
E Lolly gag 
Ll Evening Easel 
Q Etchingspin 
—I Duskpallet 
H Base coat 
H Acidwash 
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Talking Points: 



Approx. 15-20 
SiGINT Reports per 
week from MYSTIC 
sites other than 
SCALAWAG 




from MYSTIC sites 
other than 
SCALAWAG, 
ACIDWASH, and 
OILYRAG for the 
week of April 22nd - 
April 28th 



(U//FOUO) MYSTIC Reporting 
(Excluding SCALAWAG) 
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Talking Points: 



Approx. 10-15 
SiGINT Reports per 
week from MYSTIC 
sites other than 
SCALAWAG 




from MYSTIC sites 
other than 
SCALAWAG, 
OILYRAG, and 
ACIDWASH for the 
week of March 3rd - 
March 9th 



(U//FOUO) MYSTIC Reporting 
(Excluding SCALAWAG) 





111 Rancid rinse 
Q Permanent Press 
—I Lollygag 
H Etchingspin 
U Duskpallct 
H Basecoat 
—I Ac id wash 
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(U) WHAT’S NEW 



>US-3310A1/A2/BASECOAT (Bahamas) reactivated mid- 
March. Five reports issued by end of March, four sole source. 

2/00/501291-13 

(S//SI//REL TO USA, FVEY) Additionally, arranged Mexi co-to- 

United States marijuana shipments in late March. informed 

that it was possible to send up to 90 pounds of marijuana via the United 
States Postal Service without being charged with a felony, and that 
had conducted this sort of shipment successfully several times already. 

expected the marijuana to be inserted in packages after they had 
been inspected by United States customs officials in Mexico. 
believed that unspecified individuals removed the customs inspection seal, 
inserted the narcotics, and reapplied the seal. 



TOP SECRET//SI//NOFORN 









(U) Project Description 



(S//SI//REL TO USA, FVEY) The Special Source Operations (SSQ) Project provides management oversight 
and logistical support to the Special Source Access programs. These resources are used to provide cross- 
program management services to drive efficiencies within the Special Source Access Expenditure Center (EC). 
Responsibilities include general management, tra inings and tr avel. This Project supports the RAMPART-I 

po.-eir.::: the KAMPAKT-X proeiL,::: It also supports the MYSTIC I Yoyo.::: Office. 

which leverages partner-enabled accesses against Global System for Mobile Communications (GSM) and other 
cellular and Public Switched Telephone Networks (PSTNs), It supports target technology development through 
comprehensive and definitive description of foreign targets 1 current and future use of telecommunications and 
computer systems. Additionally, this Project sustains efforts to add, enhance, and support Next -Gene ration 
Wireless (NOW) capabilities across Special Source Accesses, and efforts to address critical target capability gaps. 
This Project contains the Special Source Staff Operations Sub-Project. 

(U) Base resources in this project are used to: 

* (U//FQUQ) Provide travel, training, equipment and general supplies for the Special Source Access front 
office. 

* (TS//SI//RELTO USA, FVEY) Provides initial and emerging access to high-priority SIGINT targets against 
new requirements, provide management and technical engineering services to analyze and maintain data 
flow, provide program metrics, and manage allocation of tasks and schedules for SSO collection sources. 

* (S//SI//REL TO USA, FVEY) Provide contracted services for NGW core network exploitation capabilities 

to deploy core network exploitation capabilities to collection sites Caribbean. Kenya, the 

Philippines, and Mexico. 

* (C//RELTO USA, FVEY) Purchase classified SIGINT processing equipment, associated upgrades, and 
life-cycle support. 

* (TS//SI//NF) Sustain MYST IC capabilitie s to provide comprehensive metadata access and content against 

targeted communications in I [ , Kenya, Caribbean, Mexico, Lin d the Philippi ties. Provide new 

PSTN collection capability m I . . Bon their international links to I . H and 

mp Capabilities will offer near-real time, complete access to the additional target country 's GSM 
network(s), and provide for retrospective tasking and near-real-time access/de livery of metadata as required. 
Activities previously provided by Overseas Contingency Operations (OCO) resources are now requested 
in the base submission. 








On General Information 



MYSTIC 



Yeah Established 


(U) 2009 

(TS//SL7NF) MYSTIC is an SSO program for embedded 
collection systems overtly installed on target networks, 
predominantly for the collection and processing of wireless, ''mobile 
communications networks, The overt purpose is for legitimate 
commercial services for the Telco's thems elves; our covert mission 
is the provision of SIGINT. 


Description 


Intelligence Value 




(TS//SI//NF) 2j|jS^ystem^jirecd^upport^^^HB^^^B 


Major T ah gets 


jHfli 1 ' 1 their ^ 
Terrorism, Counter Narcotics, and International Crime missions, 
(TS//SI//NF) The MYSTIC program encompasses a number of 
subprograms, which are variously sponsored by NCSC, DEA, and 
CIA. 


Major Benefactors 
& Users of Information 



5 


(TS//SI//NF) Plan for MYSTIC accesses against projected 
new mission requirements (i.e. 3G and 4G technologies. 


3.1, 3.3 




Voice data, etc.) (MOD) 





Other CIA sponsored sites: 

5. DUSKPALLET - US-3270/DA - Kenyan GSM 

6. EVENINGEASEL (US-3411A/4F) Mexican Wireless 



B) (TS//SI//REL TO USA, FVEY) ^^Sponsored 
+ Known as SOMALGET sites with common US-33 10-XX, PDDG ZD 

1. BASECOAT - US-3310 A Bahamas A-link GSM 
o Includes sites US-3310A1 and US-3310A2 







(U) DEA - The "Other" Warfighter 



FROM: 

DEA Account Manager (S112) 
Run Date: 04/20/2004 



(U//FOUO) When you think about our top national security threats, chances are that terrorism and 
military conflict come quickly to mind - and for good reason. But how many of us list illegal 
narcotics among the top direats to our society? Our national leadership recognized the seriousness 
this problem poses and declared a war on drugs two decades ago. This "war" has all the risks, 
excitement, and dangers of conventional warfare, and the stakes are equally high. 

(U//FOUO) We are all aware that the Drug Enforcement Administration (DEA) is leading our 
nation's counternarcotics (CN) efforts. But many are not aware that from the start NS A has been at 
the forefront of Intelligence Community (IC) support to this seemingly unconventional DOD 
mission. The novel collection and analysis techniques NS A developed and refined against these 
criminal hard targets have not only resulted in major successes in the war on drugs, but they have 
also proven invaluable to other critical SIGINT missions, particularly counterterrorism, sometimes 
blurring the lines between the two missions. 

(C) DEA has close relationships with foreign government counterparts and vetted foreign partners. 
The results of diis team approach regularly make the headlines in the form of major drug busts and 
arrests. Less known is the critical supporting role that NS A continues to play in key DEA operations 
to disrupt the flow of narcotics to our country and thwart other, related crimes. DEA, however, 
recognizes the unique access and sole source information NS A provides and coordinates major 
cases with the S2F/ICN Product Line. 



(C) As a result, both agencies enjoy a vibrant two-way information sharing relationship that 
enhances their common mission. Processes have been carefully established to exchange lead 
(foreign intelligence) information while protecting NS A equities. The Customer Relationships 
Directorate (SI), the Data Acquisition Directorate (S3), and MRSOC work with the S2F/ICN office 
as an integrated team to realize these mission successes. 

(S//SI) One of those successes: Based on SCS (US-9GGL) intercept, S2F/ICN issued an OPS 
IMMEDIATE report on 30 March 2004 on the exact whereabouts of Colombian narcotics trafficker 
Gonzalo Hinojosa, an evasive and brutal international fugitive wanted for murder, drug trafficking, 
and money laundering. S2F had the foresight to include a tearline to share the actionable 
intelligence with Panamanian partners. With a short window for action, NSA's^^^^^^^^l 
worked through the Joint Interagency Task Force (JITF) - South to immediately forward the 
information to DEA/Panama. DEA/Panama in turn alerted the Panamanian authorities who quickly 
located and apprehended Hinojosa, without knowing the information came from NS A SIGINT. As 
Chief noted, this is an excellent example of "outcome- oriented collaboration." 

(U//FOUO) To learn more about NS A support to the "other" warfighter, DEA, visit the International 
Crime and Narcotics (S2F) website . 






"(U//FOUO) SID today articles may not be republished or reposted outside NSANet without 
die consent of S0121 ( DL sid coiimis) ." 



Information Qwner^^^^^^^^J ( email) 

Page Publisher: 

Last Modified: 11/09/2012 / Last 
Reviewed: 11/09/2012 

DYNAMIC PAGE - HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // SI / TK // REL 
TO USA AUS CAN GBRNZL DERIVED FROM: NSA/CSSM 1-52, DATED 08 JAN 2007 
DECLASSIFY ON: 20320108 



(S//SI//REL) Iiitro: Here in S2F, we've had great success 
using systems that buffer full-take audio collection for a 
nominal 30 days — these systems have led to real 
breakdiroughs in target discovery — and we wanted to alert 
other analysts to their potential. Collectors: please take note 
of how beneficial these types of collectors can be to 
analysts, as compared to more traditional models. 




(S//SI//REL) SOMALGET is a family of collection systems which greatly facilitate and 
make possible remarkable new ways of performing both target development^ and target 

discovery.* * 2 Significant analytic breakdiroughs and successes in bodi areas have been 
made b^I^analysts in die two countries where SOMALGET accesses currently exist 
(i.e., and die Bahamas). 

(U) How It Works: 

(S//SI//REL) SOMALGET collection systems foi'ward full-take metadata in real time 
and buffer full-take audio for nominally 30 days '. 3 ^ makes possible die selection of 
audio content against die buffered data after die fact, in near real-time, or up to 30 days 
later. This ability is dubbed "retrospective retrieval." The power of retrospective 
retrieval in facilitating target development or discovery lies in its ability to permit die 
analyst to selectively retrieve audio content and immediately validate his/her tentative 
analytic conclusions derived from metadata. 



• (TS//SI//REL) SOMALGET access to Bahamian GSM communications has led to 
die discovery of international narcotics tiaffickers and special-interest alien 
smugglers . This access — togedier widi our use of mediods diat take advantage of 

targets' behavioral patterns 4 — have allowed our S2F analysts to gain a firm 
under standing of die targets' activities even when diese contacts occurred prior to 
dieir discovery. 






(U) More to Come? 

(S//SI//REL) These successes, which depend on access to buffered audio files diat may 
be associated widi selectors not tasked to die collection asset in question, argue in 
favor of a collection methodology for telephony that may be viewed as analogous to 
XKEYSCORE . That is, we buffer certain calls that MAY be of foreign intelligence 
value for a sufficient period to permit a well-informed decision on whether to 
relieve and return specific audio content Widi proper engineering and coordination, 
diere is little reason diis capability cannot expand to odier accesses (besides 
^^^^m|and die Bahamas), provided compatible hardware and interfaces are 
developed and deployed. 5 




(U) Notes: 

1. (U) Target development - die process by which ail analyst can extend his/her 
knowledge of a known target by observing elements of metadata diat relate to diat 
target. 

2. (U) Target discovery = die process whereby an analyst can discover targets by 
observing metadata as it relates to behaviors characteristic of his/her target set, 
regardless of whedier or not die newly discovered selectors are related to known 
targets. 

3. (S//SI//REL) The nominal "30 days storage” actually varies depending upon on 
space, power, and observed activity levels. 

4. (TS//SI//REL) Observing diat targets tend to use prepaid calling cards in an attempt 
to mask die destination of telephone calls, S2F focused on mobile identifiers in number 
ranges diat represent newly activated accounts. We have also used SMS text messages 
to identify and retrieve audio of interest. 

5. (S//SI//REL) Storage capacity is directly related to die amount of disk storage diat 
can be deployed. When deployed against entire networks, as SOMALGET is, die back- 
end database and processing required for interactive search and retrieval of cuts also 
requires enterprise-class data warehousing and high-performance processing to manage 
die vast amount of data captured. Currently diis warehouse dynamically manages 
roughly 5 billion call events, widi die capacity to expand well beyond our current target 
communications. This retrospective retrieval infrastructure is web based and is already 
in place. As noted, widi proper engineering and coordination, diere is little reason diis 
capability cannot expand to odier accesses, provided compatible hardware and 
interfaces are developed and deployed. 




(TS//SI//NF) MYSTIC acess; Bahamas A-link GSM. DEA access under LI that collects Counter-Narcotic 
(CN) targets. There are two sites located in the Bahamas. It is currently being used as a test bed for 
system deployments, capabilities, and improvements. 

(TS//SI//NF) NCSC covername for MYSTIC access provider 

(TS//SI//NF) MYSTIC access that collects Kenya GSM (DNR). Collection is on the Abis link and brings 
back GSM metadata with the potential for content at a later date. Similar to LAUNDROMAT accesses 
(TS//SI//NF) SIMILAR to MYSTIC'S LAUDROMAT accesses. Pending access. Will collect Mexico GSM 
for CN targets. Site will be in Mexico. 

Groupe Speciale Mobile or Global System for Mobile communications. It is the most widely proliferated 
digital cellular technology in the world today. 

Lawful Intercept 

(U//FOUO) An eight year/$51M Time & Material contract with General Dynamics, located in Annapolis 
Junction, MD, forthesupportof the LOCKSTOCK collection system used by MYSTIC and RAM-M. 

COR is currently^^^H^^I. Processes all MYSTIC data and data for other NSA accesses. 
(TS//SI//NF) SOMALGET- UMBRELLA term for systems provided by ^^^^^ ^ftNCSC) . Currently 
comprised of the SCALAWAG, OILYRAG, and LOLLYGAG collection systems and 

BASECOATin the Bahamas. Processes over 100 million call events per day. The overt mission of for 
SOMALGET is under the Lawful Intercept (LI) auspices via DEA accesses. Host countries are not 
aware of NSA's SIGINT collection using these systems. 

(TS//SI//NF) MYSTIC access via DSD asset in a Philippine provider site. Collects Philippine GSM, Short 
Message Service (SMS) and Call Detail Records. Will soon become a source of lucrative intelligence 
for terrorist activities in Southern Philippines. 



